api/graph: use a more generic UNAUTHENTICATED_HOSTS config to check access to graph API

Replace usage of the hardcoded and swh specific
SWH_WEB_INTERNAL_SERVER_NAMES by a more generic UNAUTHENTICATED_HOSTS
config option to bypass authentication for the graph public APIs.

This uses the same validation logic as django's ALLOWED_HOSTS one.